Configure a DNS Proxy Object

1. Log in to Strata Cloud Manager.
2. Select ManageConfigurationNGFW and Prisma AccessDevice SettingsInterfacesDNS Proxy and select the Configuration Scope where you want to create the DNS Proxy object.

   Select a firewall from your Folders or select Snippets to configure the DNS Proxy object in a snippet.
3. Add DNS Proxy Parameters.
4. Verify that Enable is selected.
5. Enter a descriptive Name.
6. Verify the Location of the DNS Proxy object.

   The Location is based on the folder, snippet, or firewall you selected and can’t be changed. To change the Location of the DNS Proxy object, Cancel the configuration change and select the required folder, snippet, or firewall.
7. Select the Inheritance Source.
8. Enter the Primary and Secondary DNS IP address.
9. For Interfaces, Add and select the interfaces to which the DNS Proxy object applies.

   See Configure Interfaces to create new interfaces if needed.
10. Configure the DNS Proxy Rules.

    1. Add a new DNS proxy rule.
    2. Enter a Name for the DNS proxy rule.
    3. Enable Cacheable if you want the firewall to cache the resolved domain names.

       This setting is enabled by default.
    4. Enter the Domain Name to which the firewall compares FQDN queries.

       If a query matches one of the domains in the rule, the query is sent to one of the DNS servers you specify.
    5. Enter a Primary and Secondary DNS server for this specific DNS proxy rule.

       If no primary or secondary DNS servers are specified, then the domain is sent to the DNS servers you specified in the previous step.
11. (Optional) Configure Static Entries.

    Configure a static entry to supply the DNS Proxy with static FQDN-to-address entries. This allows the firewall to resolve the FQDN to an IP address without sending a query to the DNS server.

    1. Add a static entry.
    2. Enter a Name for the static entry.
    3. Enter the IP Address you want to statically map to an FQDN.
    4. Enter the Fully Qualified Domain Name that you want to map the static IP address to.
12. Enable caching and configure other Advanced settings for the DNS Proxy.

    1. For TCP Queries, Enable to enable DNS queries using TCP.

       • Max Pending Requests—Enter the maximum number of concurrent, pending TCP DNS requests that the firewall will support. Range is 64-256; default is 64.
         This setting applies only if TCP Queries is enabled.
    2. Configure the UDP Queries Retries.

       • Interval (sec)—The length of time (in seconds) after which another request is sent if no response has been received.
         Range is 1-30; default is 2.
       • Attempts—The maximum number of UDP query attempts, excluding the first attempt, after which the next DNS server is queried.
         Range is 1-30; default is 5.
    3. Configure the Cache settings to enable the firewall to cache FQDN-to-address mappings that it learns.

       • Enable the Cache setting.
         To enable this setting, you must also enable Cache for your DNS Proxy Rules if the DNS Proxy object is used for queries that the firewall generates.
       • Enable TTL to limit the length of time the firewall caches DNS resolution entries for the DNS Proxy object.
         Enter the Interval to specify the number of seconds after which all cached entries for the DNS Proxy object are removed. After the entries are removed, new DNS requests must be resolved and cached again.
       • Cache EDNS Responses—You must enable this setting if the DNS Proxy object is used for queries that the firewall generates.
13. Save.
14. Push Config to push your configuration changes.